+ jHjO ,a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIHtHt^RIHtHtHt^RIHt^RIHtHt]P2!]4t^t/tR]R&R t]P@!R RR 7t!R ]R &]P@!RRR 7t"R]R&]R4t#RRlt$RRlt%RRlt&RRlt'RRRllt(RR/RRllt)R R!lt*!R"R#4t+R$R%lt,R&R'lt-R(R)lt.R*R+lt/R,R-lt0R.R/lt1R0R1lt2R2R3lt3R4RR5R/R6R7llt4R8R9lt5]6!0Rm4t7]6!0Rm4t8R:R;lt9RR?llt:R@RAlt;RBRCltRRHRIllt?RJRKlt@RLRMltARNROltBRPRQltCRRRSltD] P!RT4tFRURVltGRRWRXlltHRYRZltIR[R\ltJRR]R^lltKR_R`ltL] P!Ra4tM] P!Rb4tNRcRdltOReRfltPRgRhltQRiRjltRRkRlltSRmRnltTRRoRplltURqRrltVRs^/RtRulltWRvRwltXRxRyltYRzR{ltZR|R}lt[R~Rlt\RRlt]^t^RRlt_RRlt`RRltaRtbRtcRRltdRRRllteRR0tfRRRR/RRlltgRRRRRRRR]cR/thRtiRtjRRltkR#)uStructured update receipts + post-update fleet version verification. Phase 1 of the fleet-update reliability plan (#91277): the updater must *prove* its outcome instead of assuming it. Two additive capabilities, both designed so a failure inside them can never break an update (every public entry point is exception-swallowing): 1. **Update receipt** — a machine-readable JSON record of what one ``hermes update`` run discovered, did, skipped (and why), written to the ROOT home's ``logs/update_receipts/`` (``get_default_hermes_root()``, never a sticky profile's ``HERMES_HOME``). Silent-failure classes this makes visible: #88848 (helper died after "success" printed), #74973 (restart silently skipped), #85753 (restart phase never ran), #81193 (desktop shows failure for a successful update). 2. **Fleet version verification** — after the restart phase, read every profile's ``gateway_state.json``, compare each live gateway's stamped ``code_sha`` (written by ``gateway/status.py`` on every runtime-status write) against the freshly-updated checkout's HEAD, and print a fleet version matrix. Mixed-version fleets (#88654, #69754, #77553, #56717) become a loud, actionable report instead of a latent state. Deployment-kind awareness (docker/image-managed installs) rides on ``hermes_cli.version_info.get_code_identity()``: a packaged build reports its install-stamp provenance (``source="docker"``/``"nix"``/…) and the receipt records that the install is not in-place updatable. ) annotationsN)contextmanagersuppress)datetimetimezoneUTC)Path)AnyOptionalzdict[str, dict[str, Any]] _FINALIZEDzcompleted at command boundaryupdate_receipt_currentdefaultz/contextvars.ContextVar[Optional[UpdateReceipt]]_currentupdate_receipt_scope_terminalz0contextvars.ContextVar[Optional[dict[str, Any]]]_scope_terminalc#"\PR4p\P/4pRx\PV4\PV4R# \PT4\PT4i;i5i)zDKeep the command's finalization guard away from an enclosing update.N)rsetrreset)tokenterminals >/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_receipt.pyupdate_receipt_scoperEsd LL E""2&H h'u h'us+B A,B ,B  B c V^8dQhRRRR/#)datar returnNone)formats"r __annotate__r Qs....c\P4pVeH\V\4'd0VPR4'dVPR4VR&R#R#R#R#)zZA completion child finalized this command's run: its terminal outcome is this scope's too.N finished_atoutcome)rget isinstancedict)rcells& radopt_terminal_receiptr)QsN    D JtT22txx 7N7N((9-Y8O2r!cV^8dQhRR/#rrboolr)rs"rr r XsVV4Vr!c\P4p\P4RJ;'d(\V4;'dVPR4R8H#)aTrue when this command's run is closed and its receipt says ``success`` (C3). The gateway ``/update`` status written at the command boundary follows the receipt: an interrupt or error that escapes after the run closed as a success never reports it failed. Nr$success)rr%rr,)r(s rcommitted_successr/XsE    D <<>T ! U Ud4j U UTXXi5HI5UUr!cV^8dQhRR/#rr Optional[str]r)rs"rr r bs C C Cr!cN\P4pVe VP#R#)uThe update correlation id in force in this context, or None. Derived from the OPEN update receipt itself — one source of truth, no duplicate id variable: a nested update's begin replaces the current receipt (so syncs begun under it capture the nested id), and its finalize RESTORES the outer receipt via the ContextVar token (so the outer id comes back for the rest of the outer update).N)rr%correlation_idcurrents rcurrent_correlation_idr7bs%llnG%,%87 ! !BdBr!cV^8dQhRR/#)rrstrr)rs"rr r ns))c)r!cR\P!\4P4#N)rnowr isoformatrr!r _utc_now_isor>ns <<  & & ((r!Fc V^8dQhRRRR/#)rrefreshr,rdict[str, Any]r)rs"rr r rsD^r!c\\4;_uu_4^RIHpV!VR7;'g/uuRRR4# +'gi/#;i)z6Running-code identity, or ``{}`` when the probe fails.)get_code_identityr@N)r Exceptionhermes_cli.version_inforC)r@rCs& r_code_identityrGrs6 )  = 177R     Is < A pidc(V^8dQhRRRRRRRR/#) rentriesr keysztuple[str, ...]rHr,rlist[dict[str, Any]]r)rs"rr r {s)  # _ d Oc r!c N.pVFp\V\4'gKV'd(R\VPR^4;'g^4/M/pTP VUu/uFqf\ VPVR44bK up4VP V4K V#uupi)zXDict entries reduced to stringified ``keys`` (plus an int ``pid`` first when requested).rH)r&r'intr%updater9append)rJrKrHrecordsentryrecordkeys&&$ r _str_recordsrV{sG%&& KN%UYYua-@-E-EA)F!GTV tDtC #r 233tDEv  NEs $B" cV^8dQhRR/#r1r)rs"rr r sNN-Nr!cr\PPRR4P4;'gR#)aCorrelation id handed in by an external launcher, or None. Desktop's managed SSH update exports ``HERMES_UPDATE_CORRELATION_ID`` and only accepts a receipt whose ``correlation_id`` equals it. This is separate from ``update_id``, which stays the CLI's own id for pm sync receipts.HERMES_UPDATE_CORRELATION_IDrNN)osenvironr%striprr!r_launcher_correlation_idr]s+ ::>>8" = C C E M MMr!c]tRt^tRtRRltRRRlltRRltR R ltR R lt R Rlt RRRRRRRRRRRRRRRR/RRllt RRlt Rt R#) UpdateReceiptz;Collects the observable facts of one ``hermes update`` run.cV^8dQhRR/#rrrr)rs"rr UpdateReceipt.__annotate__sXX$Xr!c R^R\4RRR\\P4R\P !4RRR\ 4R /R .R .R /R ./ Vn\P!4PVn VPVPR&\4VPR&\PPRR4P4;'gRVPR&R#)schema started_atr#NargvrHr$running pre_update post_updatestepsskipsgateway_restartfleet update_idr4HERMES_ACTION_IDrN action_id)r>listsysrfrZgetpidrGruuiduuid4hexr4r]r[r%r\)selfs&r__init__UpdateReceipt.__init__s a|~}d DNE299; y .*M2 R"&7Wb %  #jjl..!%!4!4 +&>&@ "#"$0BB!G!M!M!O!W!WSW +r!rNc(V^8dQhRRRRRRRR/#rnamer9okr,detailrrr)rs"rr rbs.jjj$jjTjr!c  |VPR,PRVR\V4RVR\4/4R#)rjr|r}r~atN)rrQr,r>)rwr|r}r~s&&&&rstepUpdateReceipt.steps3 '!!64tBx6SWYeYg"hir!c$V^8dQhRRRRRR/#rr|r9reasonrrr)rs"rr rbs&ZZZcZdZr!c  fVPR,PRVRVR\4/4R#)rkr|rrN)rrQr>)rwr|rs&&&rskipUpdateReceipt.skips( '!!6464"XYr!c(V^8dQhRRRRRRRR/#rr|r9r$factsrrr)rs"rr rbs.uu#uucudur!c |VPPR.4PRVRVR\4/VC4R#)stagesr|r$rNr setdefaultrQr>)rwr|r$rs&&&,rstageUpdateReceipt.stages9 Xr*1164GUY[g[i2smr2str!c$V^8dQhRRRRRR/#rrUr9valuer rrr)rs"rr rbs!CDr!c "W PV&R#r;)r)rwrUrs&&&rfactUpdateReceipt.facts  #r!c$V^8dQhRRRRRR/#rrr9rrrr)rs"rr rbs&mmSm#m$mr!c  xVPPR.4PRVRVR\4/4R#) followupsrrrNr)rwrrs&&&rfollowupUpdateReceipt.followups3 ["-44fdHfVZ\h\j5klr!restarted_servicesNrelaunched_profilesexternally_supervised_profiles killed_pids failed_units incompleteF phase_errorfresh_recoveryc<V^8dQhRRRRRRRRRRRRR R R R R R/ #)rr list | Nonerrrrrr,rr9rzdict[str, Any] | Nonerrr)rs"rr rbs`'.'.%0'.NY'.(3'.IT'."'.7;'.RU'.. '.  '.r!c bR\T;'g.4R\T;'g.4R\T;'g.4RT;'g.U u.uFp \V 4NK up RT;'g.U u.uFp \V 4NK up R\V4RV/p VeRU U u/uF.p YP V .4U u.uFp \V 4NK up bK0 pp p \ VP R.4R4VR&VP R 4;'g/pRU Uu/uF7qVP V 4;'g.Uu.uFp\V4NK upbK9 upp VR &\ VP R .4RR R 7VR &WR &WP R&R#uup iuup iuup iuup p iuupiuupp i)rrrrrrrNskipped serve_unitsstale_runtimesT)rHrrl) requestedverifiedrelaunch_attemptedfailed)profilekind supervisorr)rr)rrr)rqrOr9r,r%rVr)rwrrrrrrrrpuresultrUr persistedrunits&$$$$$$$$ rgateway_restart_result$UpdateReceipt.gateway_restart_results !$'9'?'?R"@ !4(;(A(Ar#B ,d3Q3W3WUW.X [->->B->@->qCF->@ l.@.@b.@B.@SV.@B $z* ;"   %U)TC2D2DS"2MN2Mwc'l2MNNT )$0""9b13^$Ii ),,];AArKUk(Ukc[__S-A-G-GR-GI-GDc$i-GIIUk(Im $+7""#3R8:[ae+I& '(1# $'- #$;ABO)J(sBF4F"F ;FF F+5F+:F&F+F &F+c V^8dQhRRRR/#)rr$r9rrr)rs"rr rbs@@@@r!c VR8Xd$VPPR4'dRpWPR&\4VPR&\RR7VPR&R#) r. user_actionpartialr$r#TrDriN)rr%r>rG)rwr$s&&rfinalizeUpdateReceipt.finalizesP i DIIMM-$@$@G& )#/> - #1$#? - r!)r4rrN)__name__ __module__ __qualname____firstlineno____doc__rxrrrrrrr__static_attributes__rr!rr_r_sEX"jZum'.37'.\`'.6:'.W['.%)'.>C'.XZ'.15 '.R@@r!r_cV^8dQhRR/#)rrrr)rs"rr r sBBdBr!c8^RIHpV!4R, R, #)get_default_hermes_rootlogsupdate_receipts)hermes_constantsrrs r _receipt_dirrs 9 " $v -0A AAr!cV^8dQhRR/#)rrz list[Path]r)rs"rr r sNNzNr!c^RIHp\4V!4R, R, r!VP4VP48XdV.#W.#)a5The root store, then the profile's own when a named profile makes them differ. ``pm/`` writes its sync receipts to ``get_hermes_home()`` and receipts from before the root move live there too, so readers take both and writers mirror ``latest.json`` into it (``hermes -p pm status`` reads only that one).get_hermes_homerr)rrrresolve)rrootrs r _receipt_dirsrsA 1 NO$5$>AR$R'__&$,,.8D6MtoMr!c V^8dQhRRRR/#)rpayloadbytesrrr)rs"rr r s::5:T:r!cz^RIHp\4F&pVPRRR7V!VR, V4K( R#)zFReplace ``latest.json`` in every store a reader of this home consults. _atomic_bytesTparentsexist_ok latest.jsonN)hermes_cli.runtime_staterrmkdir)rr directorys& r _write_latestrs06"_ t4i-/9%r!c$V^8dQhRRRRRR/#)rrrrrArr)rs"rr r s&www^wwr!c ~\P!RR\VPR4;'gR44R,;'g\P !R4pTRVR, RVR , RVPR 4;'g\ P!4 RVPR 4 R 2 , #) zVOne archive file per run, named at begin so the running and terminal records coincide.z[^0-9]rNre:NNz %Y%m%d%H%M%Supdate_NN_:rNNrHrn.json)resubr9r%timestrftimerZrs)rrstamps&& r _run_filers FF9b#dhh|&<&B&B"C DS I j jT]][iMjE r 1U2YKq%9W9WBIIK8XXYZ^ZbZbcnZoYppuv vvr!c V^8dQhRRRR/#)rrnr9rz%Optional[tuple[Path, dict[str, Any]]]r)rs"rr r ss'Lr!c \\4;_uu_4\4PRV R24Fp\\\4;_uu_4\ P !VPRR74p\V\4'd0VPR4V8XdW3uuRRR4uuuRRR4#RRR4K RRR4R# +'giK;i +'giR#;i)aThe run's own archive ``(path, record)`` in the root store, or None. Never raises. The ONE lookup of a run's archive (named at begin, so its running and terminal records share one file); never ``latest.json``, which another profile or run may have replaced since. A file that cannot be read, is not a JSON object, or names another run is not this run's record: callers treat all of those exactly like a missing archive. z update_*_r utf-8-sigencodingrnN) rOSErrorrglob ValueErrorjsonloads read_textr&r'r%)rnpathrTs& rread_run_recordr s '   N'')I;e(DED':..DNNKN$HIfd++ ;0G90T</.  ..F   /..   s*=C+AC * C+ C+ C(" C++ C< c V^8dQhRRRR/#rrrArrr)rs"rr r s>dr!c j\\4;_uu_4^RIHp\ 4pVP RRR7\ W 4p\\VPR444pVe*V^,PR4'd RRR4R#^RI H p\P!/VCR\P!4R V!\P!44/C^\R 7R ,P!R 4pV!W64\#V4RRR4R# +'giR#;i) zVWrite the open run to disk: a killed update still leaves its own record. Never raises.rTrrnNr#_process_create_time writer_pidwriter_create_timeindentr utf-8)rrErrrrrrr9r%hermes_cli.process_identityrrdumpsrZrsencoder)rrrrstoredrrs& r_persist_runningrs )  : N t4)!TXXk%:!;<  &)-- ">">    E::XX|RYY[35I"))+5VX%&57;<=CVG_  d$g#    sA3D! D!BD!! D2 c V^8dQhRRRR/#)rrTrArr,r)rs"rr r 0s ; ; ;D ;r!ca^RIHo/pRF^wr#VPV4p\V\4'gK.V^8gK7VPV4pWA9g W,eKZWQV&K` \ ;QJd-V3RlVP 44F 'gK R# R#!V3RlVP 444#)r)_pid_alive_matchesc3<<"TFwrS!W4RJxK R#5i)FNr).0rH create_timers& r _owner_alive..<s%;'9#3"#35@'9sTF))rHpid_create_time)rr)r rr%r&rOanyitems)rT identitiesrUtime_keyrHrrs& @r _owner_aliver0s>J[ jjo c3  C!G!**X.K$ (?"-3\ 3;'1'7'7'9;33;3;3;'1'7'7'9; ;;r!cV^8dQhRR/#)rrrLr)rs"rr r @s$8r!c .p\\4;_uu_4^RIHp\ 4p\ 4;'g/p\ VPR4RR7\)REFp\\4;_uu_4\P!VPRR74p\V\4'd(VPR4R 8wg\V4'd RRR4KVPR 4;'g.pV'd6\VR,\4'dVR,PR 4MRpTP!R \#4R T;'gR R2R7\P$!V^\&R7R,P)R4pV!WH4VPR4VPR48Xd \+V4VP-V4RRR4EK RRR4VF3p\/RVPR4 RVPR4 R24K5 V# +'giEK;i +'giL`;i)a-Mark ``running`` records whose processes are gone as ``interrupted``; returns them. The start-of-run reclaimer for the durable running receipt: the next update says plainly that the previous one was killed and at which stage, instead of reporting its outcome as whatever ran before it. Never raises. r update_*.jsonc6VP4P#r;statst_mtimers&r,reconcile_interrupted_runs..Ms!&&(J[J[r!rUNrrr$rgrr| interruptedz.process exited during the update (last stage: start))r$interrupted_detected_at stop_reasonrr r rnu⚠ The previous update (rez&) was interrupted before it finished (r-z0); this update completes the work it still owed.)rrErrrread_latest_receiptsortedr _RECEIPT_KEEPrrrr&r'r%rrPr>r r9r rrQprint) r)rrlatestrrTrlastrs rreconcile_interrupted_runsr5@s)+K )  : N $&,,"9>>/:@[\^k]k]lmD)$$DNNKN$HI!&$//6::i3HI3UYeflYmYm%$ H-3317JvbzSW $ I.H>  H> AH> 'BH> . I> I I I# previousr4c$V^8dQhRRRRRR/#)rr6z dict | Noner4 str | Nonerrr)rs"rr r as"%#%#k%#*%#`d%#r!c \4pV'd0VPP\P!V44T;'g VP VnVPPVP RRR7VPP R4;'g \4TPR&\\4;_uu_4^RI H pVPPRV!VPR,44RRR4V'g \4V'dRV9d\\4;_uu_4\4;'g/p\VP R 4;'g/P R 4;'g.4pT\VP R 4;'g.4, pT\VP R4;'g.4, p^R IHpVUu.uFqv!V4'gKVNK upVPR&RRR4M\(P+V4Vn\/VP4R# +'giEL`;iuupi +'giLZ;i \d"p\$P'R T4Rp?R#Rp?ii;i)u6Start recording a new update receipt, durably ``running`` until it finalizes. Nested updates are safe: the previous receipt (if any) is preserved behind the ContextVar token and comes back when this one finalizes — a nested begin/finalize never drops the outer update's receipt or correlation. Never raises.rgN)rnr$r#r4rrrHcarried_manual_servesplanruntimespending_manual_serves)is_reminder_rowz"Could not start update receipt: %s)r_rrPcopydeepcopyr4r%r]rrEr rrr5r/rq#hermes_cli.update_serve_obligationsr>loggerdebugrr current_tokenr) r6r4receiptrpriorrowsr>rowexcs $$ rbegin_update_receiptrJas/  LL   h 7 8!/!I!I73I3I g&<&?EE2FFUYY'>?EE2FFOHL8eP_`cPd8e 45%$C%LL1GW\\"-! "9f%$  93?sA J AJ(/J:I(J!J3J1JJ$J*J,JI<I<J-J( I9 3 J<J J JJ KJ;;KcV^8dQhRR/#rar)rs"rr r s'''r!c\P4pVe:VPPR4R8Xd\VP4R#R#R#)zSRe-assert the open run on disk (the completion child calls this after resuming it).Nr$rg)rr%rrr5s rpersist_running_receiptrMs>llnGw||// :iG& Hr!cV^8dQhRR/#rar)rs"rr r sllTlr!c\R\;QJdRV4F 'gK RM RM !RV44'd R4R#R4R#)z^Mark the build stage from the owed ``(step, reason)`` follow-ups: failed only for a build one.buildc38"TFwrV\9xK R#5ir;)BUILD_FOLLOWUPS)rrrs& rr%record_build_stage..s)[QZgd$/*AQZsTFrr.N) record_stager)rs&rrecord_build_stagerUs4cc)[QZ)[ccc)[QZ)[&[&[(kajkr!retryz-the next launch or `hermes update` retries itc(V^8dQhRRRRRRRR/#)rrr9rrVrrr)rs"rr r s)''#'s'c'pt'r!c XRP\V4P44R,;'gRp\RV RV RV R2RR 7\P 4pVfR #\ R R V 2W4\P 4pVe\VP4R #R #) uA post-commit step failed: print ⚠, keep the run a success, and say what is still owed. The code already committed, so the update does not fail; the step's own obligation (the source tail, the fleet restart, the launch-time bytecode sweep) stays armed and the next launch or ``hermes update`` retries it. Never raises. The printed line is a protocol: the Desktop hand-offs (scripts/desktop-update/posix.sh, windows.ps1) parse ``Update follow-up '' did not finish:`` to report every owed step, so keep it one whole line.  NiNru ⚠ Update follow-up 'z' did not finish: z (r+TflushNrzupdate followup ) joinr9splitr2rr%_recordrr)rrrVr6s&&$ rrecord_followupr`sXXc&k'') *4 0 < rr r9r rrErrr/r%r)rnrrfoundrrTrrs&&& ramend_terminal_followuprgs I &E }LD k2&--vtXvtUaUc.dezz&C84?GGPG )  :d$  ! ' 'R , ,[ 9Y F ' "    s AC C, c ,V^8dQhRRRRRRRRRR/#) rrnr2rr9rrVrrr)rs"rr r s099M99c9C9TX9r!c z\W3/VB\P4fV'd\WV4R#R#R#)zA post-commit step failed: record it on the run while its receipt is open, else amend the run's closed receipt. Amending an OPEN run would append a second copy beside the one ``record_followup`` just persisted. Never raises.N)r`rr%rg)rnrrrVs&&&,r owe_followuprjs1D*E*||~) 8#,r!c ,V^8dQhRRRRRRRRRR/#) rmethodr9whatargsr kwargsrrr)rs"rr r s/;;C;s;3;#;$;r!cT^RIp\P4pVfR#VP!V4pVP!VP4Vn\ W`4!V/VB\P V4R# \d"p\PRY4Rp?R#Rp?ii;i)uDInvoke ``method`` on the active receipt; no-op when none, never raises. Copy-on-write, same rule as pm.receipt: a copied context (copy_context, asyncio.to_thread) inherits the SAME receipt object — mutate a clone and re-set it in THIS context only, so a child's records never leak into (or corrupt) the parent's receipt. NzCould not record %s: %s) r?rr%r@rgetattrrrErBrC)rlrmrnror?r6clonerIs&&*, rr_r_s ;,,. ?  '"]]7<<0 // U ; .::;sA;AA;; B'B""B'c(V^8dQhRRRRRRRR/#r{r)rs"rr r s(==c=t=S=$=r!c(\RRV 2WV4R#)z@Record one update step outcome. No-op when no receipt is active.rz update step Nr_)r|r}r~s&&&r record_steprvs Fl4&)4V> +s4Dc(V^8dQhRRRRRRRR/#) rrr9rfz list[str]r Optional[int]rr2r)rs"rr r &s)#YM]jr!cRV9d RV9dR#\PV4'dR#V^|8Xd RV9dR#RV9dR#R V9dR #0R m\V4,'dR #R #)z\:func:`git_error_stop_class` for a git call that returned instead of raising (``_git_run``).z index.lockz File existsgit_index_lockedpermission_deniedztimed out after git_timeoutzNo space left on device disk_fullstashlocal_changes_blockedcheckout_move_failedN>mergercheckout)_GIT_FILE_PERMISSIONsearchr)rrfrs&&&rrr&sev-6"9!""6**"S.&8 F*$&%D 11% r!cV^8dQhRR/#)rrr8r)rs"rr r 7sOOZOr!c^RIHpHpHpV!V!4P 44pVP fR#\ P!4pVPV\ P!439dR#V!4\ P!40R^^V0, pWSPVP0,'dR#R#)aa``delegate`` (the hand-off launched this process as its update child) or ``partner`` when the update marker names the Desktop hand-off this process runs under, else None. For an exit before the receipt opens, where this process may NOT hold the lock: at the update-lock refusal the marker belongs to whichever update holds it, so "a pid other than ours" (update_cmd._record_update_initiator, which runs under the lock) would call every refusal Desktop-started. The claim is ours only when it names us as its delegate (the posix and Windows hand-offs write that line before the update runs) or names our hand-off partner on line 1 or the delegate line (``HERMES_UPDATE_HANDOFF_PID``, the Tauri updater; our parent, a launcher between the hand-off and us). The marker is read raw: no liveness probe and no cleanup (those are lock policy, not a metrics side effect). ) _handoff_pid _parse_markerupdate_marker_pathNdelegatepartner) hermes_cli.update_lockrrr read_bytesrerZrs delegate_pidgetppidrH)rrrmarkerrHpartnerss r_started_by_handoff_partnerr7sWV -/::< =F   ))+CsBJJL11 -q!S0AAH JJ0C0C#DDD9N$Nr!c$V^8dQhRRRRRR/#)rrr9r$rrr)rs"rr r Rs!$$$c$d$r!c\\4;_uu_4\4pR^R\P!4P RTRTRVR8XdRMRRVR /R .R .R ./ p\\4;_uu_4\ 4pV'dR VR&VR8XdRVR&RRR4^RIHpV!V4RRR4R# +'giL(;i +'giR#;i)azCount an exit that fires before this run's receipt opens, in shared metrics only. No receipt is written, so the exit behaves exactly as before: at the update-lock refusal ``latest.json`` and the running record belong to the update holding the lock (opening one would replace its pointer and reconcile its archive), and the Git-operation refusal runs before the receipt, plan and snapshot by design. The row is derived from the same fields a final receipt carries (``outcome`` is ``refused`` or ``failed``), including the initiator, so a Desktop-started refusal reads ``kind=desktop`` like the same run's receipt would. Never raises. rdrnrer#r$refusedrrrhrrjrmdesktop initiatorrNrecord_update_receipt) rrEr>rtrurvr.hermes_cli.observability.shared_metrics_updater)rr$r<rclaimrs&& rrecord_stop_without_receiptrRs )  n adjjl&6&6 c=Z] Gy$8yh &,Hb'2wXZ  i /1E$-[! "#+Y! Yd##  !    s$AC 6$B: C : C C  C c(V^8dQhRRRRRRRR/#)rr$r9rmrr-rOptional[Path]r)rs"rr r ps0[[S[[RU[_m[r!c\P4pVfR#\P!V4p\P!VP4Vn\ VRR4pVe\P V4M\PR4VPV4V'dW$PR&VP\\VPPR44&\VP4VeWPR&^RI HpRVP9d)RVPPR4;'g./pM\!4;'g/pV!V4pV'dWPR&^R IHp V P'VP(R R 7p \+V \,4'dRF0p V PV 4fKW,VPR V 2&K2 V PR 4eV PR 4VPR&V PR4'dV R,VPR&V PR4eV R,VPR&\54p T P7R R R7^RIHp\=YP4p\>P@!TP^\R7R,PCR4pT!TT4\E\.4;_uu_4\GT4RRR4\IT 4\KTP4T# \d\PR4ELi;i \.d"p \0P3RT 4Rp ? ELRp ? ii;i +'giL;i \.d0p \0PMRY 4\ORT 24Rp ? R#Rp ? ii;i)aFinalize + persist the receipt (``success``/``partial``/``failed``/``refused``); path or None. Exactly-once by construction: the context's receipt is popped first, so a second call (e.g. the command-boundary safety net after an inner path already finalized) is a no-op returning None. The receipt is popped via its OWN begin token, so a nested update's finalize RESTORES the outer update's open receipt and correlation instead of discarding them. NrDr-rnrm)retain_receipt_manual_servesr:r=)rET)consumepm_r$pm_sync_outcomewarnings pm_warningsrefusal pm_refusalz!pm sync-section embed skipped: %srrrr r z'Could not write update receipt (%s): %su" ⚠ Update receipt not written: ) venv_rebuild plugin_bisect feature_listrj exit_code)(rr%r?r@rrqrrrrr r9r)rArpopr/pmrElast_for_updater4r&r'rErBrCrrrrrrr r rr_prune_old_receipts_publish_shared_metricswarningr2)r$rmr-r6rErrrFpending pm_receiptsyncrUrIrrrrs&&& rfinalize_update_receiptrpsllnGii G==.GL G_d 3E   NN5 ! LL  D! *5LL ':A 3w||'' 456w||,  $)LL ! U "gll 2,gll.>.>?V.W.].][]^E')//RE.u5 4;LL0 1 C 0--g.D.Dd-SD$%%bCxx}048I s3%[1c88I&26:hhy6IGLL!2388J''26z2BGLL/88I&215iGLL.!N t4 ;LL1::gll1cBTIQQRYZdG$ i ' "!I& - E   T` C LLM N4.B#N4N4(N4;N4 AM2A#M2?M2BN4 N!!)N4 M/.M/2 N=NN4NN4! N1 ,N44 O.?$O))O.cV^8dQhRR/#rrOptional[bool]r)rs"rr r sFFFr!cz\\PPR4RR4pVfR#V!4p\ T4\ JdR#RF,p\T\ 4'dTPT4MRpK. \T\ 4;'dTPR4RJ# \dR#i;i)zShared-metrics consent via the ALREADY-LOADED config module (never an import: this interpreter predates the checkout swap). None when it cannot tell (not loaded, unreadable config).zhermes_cli.configread_raw_config_readonlyNenabledT) telemetryshared_metrics)rqrrmodulesr%rEtyper'r&)readerconfigrUs r_collection_enabled_nowrsS[[__%89;UW[ \F ~h F|4.$.vt$<$<C$/ fd # E E 9(=(EE sB++ B:9B:z(?:[A-Z][A-Za-z0-9_]{0,63}:(?: \[(?:Errno|WinError) \d+\])?|historical takeover preparation failed|Windows gateway recovery failed)z[a-z][a-z0-9_]{0,39}c V^8dQhRRRR/#)rrrArr)rs"rr r s&&.&^&r!c FaV3RlR4wrp\V\4'dTM/p\V\4'dTM/p\V\4'dTMRp\P V4pSP R4pSP R4p /RSP R4bR SP R 4bR SP R 4bR SP R 4bR SP R 4bR SP R 4R8XdRMRbRRVP R4/bRSP R4;'gRU U u.uF<p \V \4'gKRU u/uFqV 9gK WV ,bK up NK> up p bRSP R4;'gRU u.uFQp \V \4'gKV P R4R8XgK3RRR\ V P R44/NKS up bRSP R4;'gRU u.uF.p \V \4'gKRV P R4/NK0 up bR\V\4'd\PV4'dTMRbR\V \4'd\V \ 4'gT MRbRV'dVP^4M V'dRMRbR\ SP R44bRRU u/uFq\ VP V 44bK up bRSP R4;'gRU u.uF7p \V \4'gKV P R 4R8XgK3R R/NK9 up b#uup iuup p iuup iuup iuup iuup i) aqOnly what shared_metrics_update.update_receipt_fields reads; never argv or step text. Every field the classifier reads is kept in closed form so a parked run classifies exactly as the same run finalized in-process: the exit's ``stop_class`` token, the exit code, the stop reason's leading label (``-`` for any other text), and flags for the restart/user-action facts. c3F<"TFpSPV4xK R#5ir;r%)rrUrs& rr"_metric_receipt..s'rAq# Aqs!rhrlr-rNrrrdrnrer#r$rrN commit_daterr|rj admissionr}rmstate-rruntime_outcomesr)rhrlr-r)r|r$rmode)rrr) r&r'r9_PARKED_REASON_LABELmatchr%r,_STOP_CLASS_TOKEN fullmatchrOgroup)rraw_pre raw_restart raw_reasonprerestartrlabelrrmarkrUrrHsf r_metric_receiptrs(sAq'r$G*%/%>%>'BC-7 T-J-JkPRG *:s ; ;*F & &v .E,'J%I $((8$ TXXk* ,8$((<:P  txx . 1:488I;N  $((;"79"DY$   }cggm&<=   *00b0 0JtT4J Y'H X'HSWK^Ss)^'H X0   )//R/ /:dD3I >NRhhW]N^bmNm >V[$TXXd^(< =/   '9J9P9Pb9Pj9P#T^_bdhTi-7CGGG,-9Pj  Jz3$?$?DUD_D_`jDkDkjqu  *Y"<">cggenX\X`X`afXgFg !'>'@ A   *++ !'?'A B    Yd#    s$2D AD:D%DD D* c V^8dQhRRRR/#)rrnr9rOptional[dict[str, Any]]r)rs"rr r Zs===)A=r!cv\P\V44pVe\P!V4#R#)u6The terminal record this process finalized for ``update_id``, published or not. The completion child answers its parent from this when the receipt store refused the terminal write: the run is still correlated and terminal, only its archive is missing (already reported by ``⚠ Update receipt not written``). N)r r%r9r?r@)rnrs& rfinalized_receiptrZs/ >>#i. )D"&"24== <r!c\P4pVe.\\VPPR444MRpVfR#Vwr#VPR4'd#\P VP 4V#VPRR4\P!V4pW4n\PV4R# \d\PR4T#i;i)aCarry the open run forward from its own archive when another process took it further. The completion child resumes this process's snapshot and persists stages (or closes the run) the snapshot never saw; closing the run from that stale snapshot would erase them. Returns the archive when the run is already closed there (the open receipt is dropped: nothing is left to finalize), else None. Never raises. Nrnr#r) rr%rr9rrrDrrrr?)r6rfrrTrrs rresume_run_recordrsllnGCJCVOC 0 0 => ?\`E }LD zz-    NN700 1  JJ|T" IIg EJ LL   LL   s*C C43C4rc$V^8dQhRRRRRR/#)rr-r9rrOrrr)rs"rr r s'KKSKKVdKr!c\RRR7\P4fR#\4pVeV#\ \ 4;_uu_4\ P !\P44p\ P!VP4Vn\V4VPR&\PV4RRR4\RVR7# +'giL;i)adClose a run the operator interrupted AFTER the commit point as ``interrupted``. Never raises. Not ``failed``: the code already moved, so "still on the previous version" would be false; the armed obligations finish the rest. The run's own on-disk record is preferred when it is further along (the completion child persisted stages this process never saw). u⚠ Interrupted after the code was updated: the new code is in place; its remaining steps are owed and the next launch or `hermes update` finishes them.Tr[Nrr)r) r2rr%rrrEr?r@rrOrr)r-rclosedrrs&$ r#finalize_interrupted_update_receiptrs  BIMO||~  F  )   (,,.)]]5::. "%i. ; U  #=k JJ  s A;C C- c V^8dQhRRRR/#)rrrrrr)rs"rr r s4Dr!c `\\4;_uu_4RVPR44p\VRRR7\RF3p\\ 4;_uu_4VP 4RRR4K5 RRR4R# +'giKR;i +'giR#;i)c3T"TFqP4'gKVxK R#5ir;)is_file)rrs& rr&_prune_old_receipts..sN>!))+AA>( (r c6VP4P#r;r"r%s&rr&%_prune_old_receipts..sAFFH4E4Er!TrUreverseN)rrErr0r1runlink)rreceiptsstales& rrrsz )  Ny~~o>NH*EtTUbUcdE'"" #"e  #""   s$A B!B 2 B B B B- c V^8dQhRRRR/#rrmrLrr,r)rs"rr r s';tr!cV\4R, p\P!VPRR74p\ V\ 4'gR#\ V4VR&VPR4p\ V\ 4'g/pVPRRRR /4\4VR &WCR&V!V4'gR#\\P!V^\R 7R ,PR 44R# \d"p\P!RT4Rp?R#Rp?ii;i)aRecord on ``latest.json`` that the fleet it still reports as owed now serves the checkout. A failed receipt whose plan rows cannot be matched to a live gateway (unknown identity, pre-pull SHAs) keeps ``hermes update`` exiting 1 and every CLI start warning about mixed modules, long after the operator's ``hermes gateway restart`` fixed the fleet (#117051). The caller has just verified every live row is current at the checkout SHA; persisting that matrix as the receipt's post-restart ``fleet`` (and un-flagging ``gateway_restart``) is what lets the stale-runtime readers see the recovery. ``discharges(settled_receipt)`` decides on the in-memory copy; ``latest.json`` is rewritten only when it answers True, so a catch-up that still owes the restart leaves the receipt byte-identical. Only the ``latest.json`` pointer is rewritten; the archived per-run file keeps the original outcome. Never raises. rrrFrmrlrrrNsettled_from_live_fleet_atrr r Tz>Could not settle latest update receipt from the live fleet: %sN)rrrrr&r'rqr%rPr>rr r9r rErBrC)rm dischargesrrErlrIs&$ rsettle_latest_receipt_fleetr0s~ -**T^^[^AB'4((;!++&78/400 O e]BGH8D45%4!"'""tzz'!SADHPPQXYZ  UWZ[s%A C<A+C<>.s):):r!r(rr) rrErr!maxrrrr&r')dpointsrrs rr/r/s )  .;_^_]AR@[@[@]#!m##_^   6:;**T^^[^AB$Wd33w  _   s) CC C C*A CC C c V^8dQhRRRR/#)rrpr9rrr)rs"rr r s  s /G r!c L\4pV'dVPR4V8XdV#\\4;_uu_4R\ 44p\ VRRR7Fp\\4;_uu_4\ P!VPRR74p\V\4'd/VPR4V8XdVuuRRR4uuuRRR4#RRR4K RRR4R# +'giK;i +'giR#;i) zNewest receipt written by the dashboard action ``action_id`` (``latest.json`` first, then the retained archive), or None. Never raises.rpc3R"TFqPR4Fq"xK K R#5i)r N)r)rr6rs& rr*read_receipt_for_action..s P!8O1A8OAs%'c6VP4P#r;r"r%s&rr&)read_receipt_for_action..s16683D3Dr!Tr&rrN) r/r%rrErr0rrrr&r')rpr3archivesrrs& rread_receipt_for_actionr?s! "F &**[)Y6 )  P}P8)DdSD)$$**T^^[^%IJgt,,Y1V"%$  %$T   %$$   s+;D=AC>  D( D> D D D# cV^8dQhRR/#)rrzlist[tuple[str, Path]]r)rs"rr r s.r!ca^RIHpHpHo.pV!4pVP 4'dVP RV34V!4pVP 4'd3VP V3Rl\VP4444V#)zT``(profile, home)`` for the default home plus every valid named profile dir, sorted.)_get_default_hermes_home_get_profiles_root_PROFILE_ID_RErc3<"TFapVP4'gKVPR8wgK.SPVP4'gKQVPV3xKc R#5i)rN)is_dirr|r)rrSrDs& rr!_profile_homes..sW /||~ "'** "9 >L>R>RSXS]S]>^ UZZ /sA,A,A,A,) hermes_cli.profilesrBrCrDrFrQextendr0iterdir)rBrChomes default_homerrDs @r_profile_homesrMst``$&E+-L i./  D {{}}   /  Lr!c V^8dQhRRRR/#)rhomerrzOptional[tuple[int, dict]]r)rs"rr r s4$>r!c^RIHpV!V4pV'd\VPR44V3#R# \dR#i;i)u``(pid, identity)`` declared by the gateway owning ``home``'s control socket, else None. A live ``identify`` answer is authoritative — no PID-reuse or stale-file heuristics. Callers fall back to ``gateway_state.json`` for gateways that predate the socket or whose socket didn't bind. )identify_gatewayrHN)gateway.control_socketrQrOr%rE)rOrQidentitys& r_socket_identityrT sH <#D)7?HLL'((3ITI s666 AAc V^8dQhRRRR/#)rrawr rrr)rs"rr r s  S ^ r!c\V\4'd V'gR#\\4;_uu_4\ V4pVP 4'g RRR4R#V.VP OR\FCpVR, R, P4'gK)VP4uuuRRR4# RRR4R# +'giR#;i)z?Return the Hermes checkout containing an absolute process path.Nrzmain.py) r&r9rrEr is_absoluter_CODE_ROOT_MAX_DEPTHr!r)rV candidateparents& r_code_root_for_pathr\s c3  s )  I $$&&  !59#4#456K7KLF% 1::<<~~''  M     s#C %:C $C C  C cV^8dQhRR/#rr)rs"rr r ,s>>N>r!c`\\\\4P 444#r;)r\r9r__file__rrr!r_updater_code_rootr`,s s4>#9#9#;< ==r!c$V^8dQhRRRRRR/#)rrHrOrOrrrr)rs"rr r 0s!  C t  r!c \\4;_uu_4^RIHpV!VR, 4;'g/p\ VP R44V8XdDVP R4;'g.F$p\ V4pV'gKVuuuRRR4# RRR4\\4;_uu_4^RIpVPV4p\\4;_uu_4\ VP4;'g/P R44pV'dVuuRRR4uuRRR4#RRR4.p\\4;_uu_4VPVP44RRR4\\4;_uu_4TPVP4;'g.4RRR4VF$p\ V4pV'gKVuuuRRR4# RRR4R# +'giELm;i +'giL;i +'giL;i +'giL~;i +'giR#;i)zEResolve the checkout served by a verified live gateway when possible.)read_runtime_statusgateway_state.jsonrHrfN VIRTUAL_ENV)rrEgateway.statusrcrOr%r\psutilProcessr[rQexerIcmdline) rHrOrcrTproberrgprocessprobess && r_gateway_code_rootrn0s )  6$T,@%@AGGR vzz% !S (F+11r1*514K   2  )  ..% i &(9(?(?R'D'D]'STD!   ! i MM'++- (! i MM'//+11r 2!E&u-Dt !   " 7   ! !   " sAG>/G> G>G>9-I &:H !H " I 8!I  H% 9I *H8 I $I 2I > H  H" I % H5 0I 8 I I  I externalrestart_pendingc V^8dQhRRRR/#)rrHr rr,r)rs"rr r YsHHHHr!cb\V\4;'dVPR4\8H#)z@Whether a fleet row serves a checkout this update did not touch.r)r&r'r%EXTERNAL_STATE)rHs&rrow_is_externalrtYs% c4 G GSWWW%5%GGr!cDV^8dQhRRRRRRRRRRR RR R R R R RRRRR/ #)rrr9rHrOcode_shar code_version expected_shar code_rootr expected_rootserved_profilesself_restart_pending Optional[set]rrAr)rs"rr r ^sl &)9<LO '5".ss&E3B4 4&&$&?s) )FTr{)rsr9RESTART_PENDING_STATEr&rqallr'fromkeys) rrHrvrwrxrryrzr{r|rHs &&&&&&&&&& r _fleet_rowr^s  iMi>X h< ]c,.?? W 0S5P%7E3 XCMSW guyS^d C/4((_E3BEE3BEBB"&dmmO&D!E  Jr!stoppedstartup_failedpre_restart_pidsr|c$V^8dQhRRRRRR/#)rrzOptional[list[int]]r|r}rrLr)rs"rr r ~s)ZZ,ZKXZZr!cT;'g.Uu0uF&p\V\4'gK\V4kK( ppT;'gRUu0uF&p\V\4'gK\V4kK( pp.p\RR7PR4p\ 4p^RIHpHp Hp \4EFwr\V 4p V egV wr\WVPR4VPR4VVPR4\W4VVR 7 pVP/VCR R /C4K{V !V R , 4pV'gK\VPR 44pT!T 4T8Xd\TP\YTPR4TPR4TTPR4\Y4TTR 7 4EKT !T4'd!TP\YRRR44EKETPR4pY9gEK_\T\ 4'gEKxT'gEKT\"9gEKTP\YRTPR4RRR74EK V#uupiuupi \\3dEKi;i \$d"p\&P)RT4Rp?T#Rp?ii;i)uSnapshot every profile's gateway code identity vs. the current tree. ``self_restart_pending`` — pids of gateways that are ancestors of this updater and accepted a self-restart request (cron update inside the gateway tree, #100179). They can only restart after this process exits, so their pre-update ``code_sha`` is expected: such a row is ``restart_pending`` instead of ``stale`` and does not fail the matrix (#119597). Every other live gateway on the old sha keeps its ``stale`` verdict. Rollout safety: ``down`` requires membership in ``pre_restart_pids`` — a stale state file from a long-dead gateway (machine reboot, manual kill weeks ago) must NOT fail every future update. Without a pre-restart snapshot (``None``/empty) dead PIDs are skipped (historical behavior). ``stale`` — gateway stamped a code_sha that differs from the updated checkout's HEAD (it is still serving pre-update modules). ``unknown`` — gateway predates the code-identity stamp (started before this feature landed), identity could not be resolved, or the state file's live PID is not the verified gateway for that home (``live_gateway_pid_for_home``): ``write_runtime_status`` re-stamps ``pid``/``code_sha`` for whatever process writes it, so a foreign writer must never read as ``current`` (#110420, sibling of #109680). ``down`` — the gateway was ALIVE when this update started (``pre_restart_pids``), its runtime status still says running, but the PID is dead and no successor rewrote the record: the restart phase stopped it and nothing came back. Without this row a killed-and-never-replaced gateway produced NO entry at all and the matrix passed silently (Phase-1 verification gap, #88848/#74973 class). TrDr )live_gateway_pid_for_homercruntime_status_pid_is_liveNrvrwr{)r{ryrzr|sourcesocketrdrH gateway_statedown)rzFleet version probe failed: %sr)r&rOrGr%r`rfrrcrrMrTrrnrQ TypeErrorrr9_NOT_EXPECTED_STATESrErBrC)rr|r _pre_restart_pendingresultsrxrzrrcrrrOsockrHrSrHrTgw_staterIs$$ rcollect_fleet_versionsr~sv4&6%;%;%;S%;q 1c@RFCF%;LS!5!;!;!;S!;1 1c@RA!;HS$&G!$/33E:L&(M:<  ,-MG#D)D $  (,,z":HLLXZf(. 3D(E"4S"?}-5  *&11z'dDIJzz/2H"z(C'@'@XXRZbvRvz'fjj>XZ^flmnc.h NATS8z*  B < 5s;; N.s!Xue '0BFW0Wur#r*uB ⚠ Stale gateways keep serving pre-update code until restarted.ru7 ⚠ Down gateways stopped serving messaging entirely.u ⚠ Gateway restart still owed: z4 gateway(s) still running the old code (or stopped).zT Run `hermes gateway restart` (or `hermes -p gateway restart` for a namedz4 profile), then `hermes gateway status` to confirm.)r2rr%addrtrQ_FLEET_ROW_IDENTITY_PENDING_FLEET_ROW_UNKNOWN_FLEET_ROW_LINESrr&r9rsum)rmstatesexternal_rootsrSr fallbackline stale_or_downs& rprint_fleet_version_matrixrs  G ! UF "Nii # 599W%& 5 ! !eii &<&<  ! !UYYy%9$:"UYY{=SQ[\_adQeQejmc"gsvH    WX"D F4&/ "#&  Z[ OPXuXXM  f  V W V  K L  .}o=q r t de DE 1 r!)F>rP launchers completion maintenance dependencies profile_syncconfig_migration>rPrrrr;)NrN)rNNNN)l__conditional_annotations__r __future__r contextvarsr?rloggingrZrrrrrrt contextlibrrrrrpathlibrtypingr r getLoggerrrBr1r __annotations__COMMAND_BOUNDARY_STOP_REASON ContextVarrrrr)r/r7r>rGrVr]r_rrrrrrrr5rJrM frozensetTAIL_FOLLOWUPSrRrUr`rcrgrjr_rvryrTr~rrcompilerrrrrrrrrrrrr rrrrrrr0r/r?rMrTrYr\r`rnrsrrtrrrrrrr)rs@rrs:#   /,,   8 $ (* %*>=H?@Al ' F*H :"#34Z/3Z[_Z|E P yf 0 | 1 0r!